spring-mvc 与 openid4java

以GoogleOpenID 为例，试验了OAuth单点登录的用法：

 <dependency>
     <groupId>org.openid4java</groupId>
     <artifactId>openid4java</artifactId>
     <version>0.9.8</version>
 </dependency>

 import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.openid4java.OpenIDException;
 import org.openid4java.consumer.ConsumerManager;
 import org.openid4java.consumer.VerificationResult;
 import org.openid4java.discovery.DiscoveryInformation;
 import org.openid4java.discovery.Identifier;
 import org.openid4java.message.AuthRequest;
 import org.openid4java.message.AuthSuccess;
 import org.openid4java.message.ParameterList;
 import org.openid4java.message.ax.AxMessage;
 import org.openid4java.message.ax.FetchRequest;
 import org.openid4java.message.ax.FetchResponse;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.util.UriComponentsBuilder;
 
 import com.google.common.base.Throwables;
 
 @Controller
 @RequestMapping("/openid")
 @SuppressWarnings("rawtypes")
 public class SecurityOpenIDController {
 
     public static final String GOOGLE_ENDPOINT = "https://www.google.com/accounts/o8/id";
     private static final Logger LOGGER = LoggerFactory.getLogger(SecurityOpenIDController.class);
 
     public final ConsumerManager manager = new ConsumerManager();
 
     @RequestMapping("/login")
     public void login(
             UriComponentsBuilder builder,
             HttpServletRequest request,
             HttpServletResponse response
         ) throws Exception
     {
         // configure the return_to URL where your application will receive
         // the authentication responses from the OpenID provider
         String returnUrl = builder.path("/openid/return").build().toUriString();
 
         // --- Forward proxy setup (only if needed) ---
         // ProxyProperties proxyProps = new ProxyProperties();
         // proxyProps.setProxyName("proxy.example.com");
         // proxyProps.setProxyPort(8080);
         // HttpClientFactory.setProxyProperties(proxyProps);
 
         // perform discovery on the user-supplied identifier
         List discoveries = manager.discover(GOOGLE_ENDPOINT);
 
         // attempt to associate with the OpenID provider
         // and retrieve one service endpoint for authentication
         DiscoveryInformation discovered = manager.associate(discoveries);
 
         // store the discovery information in the user's session
         request.getSession().setAttribute("openid-disc", discovered);
 
         // obtain a AuthRequest message to be sent to the OpenID provider
         AuthRequest authReq = manager.authenticate(discovered, returnUrl);
 
         // attribute Exchange
         FetchRequest fetch = FetchRequest.createFetchRequest();
         fetch.addAttribute("email", "http://axschema.org/contact/email", true);
         fetch.addAttribute("firstName", "http://axschema.org/namePerson/first", true);
         fetch.addAttribute("lastName", "http://axschema.org/namePerson/last", true);
 
         // attach the extension to the authentication request
         authReq.addExtension(fetch);
 
         if (!discovered.isVersion2()) {
             // Option 1: GET HTTP-redirect to the OpenID Provider endpoint
             // The only method supported in OpenID 1.x
             // redirect-URL usually limited ~2048 bytes
             response.sendRedirect(authReq.getDestinationUrl(true));
         } else {
             // Option 2: HTML FORM Redirection (Allows payloads >2048 bytes)
             response.sendRedirect(authReq.getDestinationUrl(true));
         }
     }
 
     @RequestMapping("/return")
     public void verifyResponse(HttpServletRequest request) {
         String email = null;
         String lastName = null;
         String firstName = null;
 
         try {
             // extract the parameters from the authentication response
             // (which comes in as a HTTP request from the OpenID provider)
             ParameterList response = new ParameterList(request.getParameterMap());
 
             // retrieve the previously stored discovery information
             DiscoveryInformation discovered = (DiscoveryInformation) request.getSession().getAttribute("openid-disc");
 
             // extract the receiving URL from the HTTP request
             StringBuffer receivingURL = request.getRequestURL();
             String queryString = request.getQueryString();
             if (queryString != null && queryString.length() > 0) {
                 receivingURL.append("?").append(request.getQueryString());
             }
 
             // verify the response; ConsumerManager needs to be the same
             // (static) instance used to place the authentication request
             VerificationResult verification = manager.verify(receivingURL.toString(), response, discovered);
 
             // examine the verification result and extract the verified
             // identifier
             Identifier verified = verification.getVerifiedId();
             if (verified != null) {
                 AuthSuccess authSuccess = (AuthSuccess) verification.getAuthResponse();
 
                 if (authSuccess.hasExtension(AxMessage.OPENID_NS_AX)) {
                     FetchResponse fetchResp = (FetchResponse) authSuccess.getExtension(AxMessage.OPENID_NS_AX);
 
                     List emails = fetchResp.getAttributeValues("email");
                     email = (String) emails.get(0);
 
                     List lastNames = fetchResp.getAttributeValues("lastName");
                     lastName = (String) lastNames.get(0);
 
                     List firstNames = fetchResp.getAttributeValues("firstName");
                     firstName = (String) firstNames.get(0);
 
                     LOGGER.debug("email: {}", email);
                     LOGGER.debug("lastName: {}", lastName);
                     LOGGER.debug("firstName: {}", firstName);
                 }
                 // success
 
                 // 在这里与安全框架集成 apache-shiro/spring-security
                 // 这里要根据相关的信息自己定义Principal
             }
         } catch (OpenIDException e) {
             LOGGER.error(e.getMessage(), e);
             Throwables.propagate(e);
         }
     }
 }